Ten years ago, almost to the day, Estonia came under sustained cyberattacks, which targeted our banks, media and government.

While the attacks themselves ultimately proved merely a nuisance, they raised global awareness of the vulnerabilities networked societies face and put a new, fundamental security challenge on the global agenda.

Thank you for reading EUobserver!

Subscribe now and get 40% off for an annual subscription. Sale ends soon.

EUobserver is an independent, not-for-profit news organization that publishes daily news reports, analysis, and investigations from Brussels and the EU member states. We are an indispensable news source for anyone who wants to know what is going on in the EU.

We are mainly funded by advertising and subscription revenues. As advertising revenues are falling fast, we depend on subscription revenues to support our journalism.

Over 200,000 victims in more than 150 countries across the globe have recently been hit by perhaps the most significant global cyberattack to date. Among them were hospitals in the UK, which had to cancel medical procedures, and large corporations such as Telefonica and Renault-Nissan.

Ransomware attacks like the WannaCry campaign have been a growing problem for several years.

They work by infecting a machine, encrypting its hard drive and then displaying a message that promises functionality will be returned to normal upon payment of a fee – in this case 300-600 dollars per system.

When it hits unprepared organisations, a cyberattack can bring mission-critical operations to a standstill.

While ransomware can sometimes be removed, the only solution is often to wipe the affected machines and revert to a backup, if one exists.

Otherwise, data could be lost forever, as there are still no reliable reports of data recovery from systems encrypted with the WannaCry ransomware.

The events over the past two weeks have highlighted our collective reliance on the digital domain, but they have also shown its vulnerabilities.

In general, a digital way of life does not necessarily carry with it greater risks, but it is different from paper-based bureaucracies.

No victims in Estonia

Yet vulnerability does not inevitably mean compromise. This particular attack could easily have been avoided by basic security practices, such as replacing out-dated software and installing critical updates.

Indeed, some countries were not seriously impacted. In fact, no Estonian computer or system fell victim to this attack. And part of the reason was preparedness.

Estonian authorities have been working for several years to raise awareness of the risks of ransomware – by not updating systems, addressing vulnerabilities and implementing baseline security standards.

The healthcare sector, in particular, has been a focus of improving IT management routines.

Furthermore, the risks and vulnerabilities – and ways of avoiding or mitigating them – must be driven home to anyone who owns or manages an information system or computer network, however small.

The Estonian example is encouraging.

For instance, when Windows XP – the no-longer-supported Microsoft operating system, at the heart of the ransomware attacks – was about to become obsolete in 2013, a well-targeted public awareness campaign almost halved the number of Estonians using it.

Nevertheless, there are still no grounds for complacency. Further cyberattack campaigns may exploit different vulnerabilities, and there is no silver bullet to prevent them.

Any comprehensive approach must address the full range of activities from prevention and awareness to response and recovery, while also ensuring that the malicious actors (“bad guys”) behind a cyberattack are discovered, apprehended and deterred in the future.

Cyber security, simply put, is too fundamental to everyday life to be left up to technology experts or particular national authorities.

A sustainable solution is possible, but only through intense international cooperation: no nation can be truly isolated in cyberspace, therefore going it alone is not an option.

Potential for Europe

We see a major European role in every step along the way.

First of all, Europe can contribute to preventing such attacks from occurring in the future.

Currently being transposed into domestic law, the EU directive on Network and Information Security (NIS) requires providers of essential services – including healthcare and transport – to follow certain best practices and implement baseline security standards on their systems.

A cooperation group of national authorities responsible for cyber security will coordinate national cyber standards and rules, and focus, in particular, on cross-border vulnerabilities and dependencies in vital services.

While awareness about cybercrimes has increased as a result of recent wide-impact incidents, a lack of basic check ups still enables crimes such as ransomware.

The EU agency for law enforcement training (Cepol) already provides education on ransomware for European law enforcement authorities. Awareness campaigns for law enforcement, businesses, and citizens more broadly, have also been quite effective.

When large-scale attacks do occur, the response from public authorities must be swift and coordinated. Timely international and cross-sector sharing of alerts and operational information can slow the spread of such attacks. Joint campaigns and responses are even more effective.

In February of this year, the Maltese rotating EU Council presidency launched the work of the European Computer Security Incident Response Team (CSIRT) network, tasked with ensuring the seamless cooperation of national cyber incident response teams in the EU.

The CSIRT network will reach full operational readiness in 2018, and should facilitate the sharing of information between EU member states.

The WannaCry ransomware case is certainly accelerating the process and provides a first test to the partners.

Identify and capture

After an attack, we must identify and capture the cyber criminals behind it.

The EU's police agency, Europol, already coordinates active cooperation between European law enforcement with partners beyond Europe and, in particular, provides a suite of tools to help victims of ransomware to decrypt their files.

Furthermore, the European Commission is to propose EU-level action for better cooperation on the exchange of electronic evidence, which would reinforce the ability of law enforcement and prosecutors to identify and prosecute criminals.

To enable a smoother transfer of evidence in criminal investigations between the member states, it is also crucial that the European Investigation Order directive is efficiently transposed into national legislation by all countries involved. The deadline for implementing the directive was 22 May 2017.

While the WannaCry attack appears to be criminal in nature, state actors are often involved in the activities of cyber criminals. Where this is the case, the EU should respond appropriately.

Last year, the Dutch EU Council presidency began work on an EU joint-diplomatic response to state-sponsored malicious cyber activity, which could include sanctions.

The EU will also begin several new initiatives this year when Estonia assumes the EU Council presidency for second half of the year.

In the autumn, the EU Commission will update the 2013 EU Cyber Security strategy. The new document should consolidate the work done on European and national levels, and ensure that the whole activity adds up to more than just the sum of its parts.

We also expect a proposal on European cyber security labelling and certification, which should make it easier for consumers and companies to make cyber-aware purchases and put market pressure on businesses to produce and offer more secure services and products.

Along with the updated strategy, we will begin work on revising the mandate of The European Union Agency for Network and Information Security (Enisa) – Europe’s cybersecurity agency.

Playing a central role in the implementation of NIS Directive, the agency is to provide a common threat landscape, coordinate the activities of member states and enhance the platform for information exchange. These, altogether, foster an environment in which all nations are more ready to counter cyber threats.

No choice left

Cyber security is a question of a way of life. Europeans are used to the benefits and advantages of digital services and the availability of electronic networks.

Nations have no choice but to build up robust cyber security measures – reverting to a paper-based system would not be more secure, is as prohibitively expensive as it is impractical, and would rob us of the conveniences we currently enjoy.

The almost-crippling WannaCry campaign highlighted the immediacy of truly international and cross-sector solutions. Cyber security is not simply the prerogative of a narrow range of technical experts or particular agencies.

As said previously, Estonia will hold the rotating presidency of the Council of the EU in the second half of this year.

We believe that the Digital Single Market and the free movement of data within the EU are of existential importance for Europe – we must keep pace with technological chances, and growing markets in America and Asia.

We cannot allow the fear of cyber attacks to slow us down, but we also have to invest the political effort and necessary capital to make sure that Europe can keep its citizens safe and its businesses secure.

Taimar Peterkop is the director general of the Estonian Information System Authority

Investigation

French president Francois Hollande has called for "all necessary means" to be used to fend off cyber attacks ahead of the presidential election in April and May. But political parties are still vulnerable.